SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an IAM user with S3 access and store the access key and secret key in a local configuration file.

  Why it's wrong here

  Storing static credentials in local configuration files is a high-risk security practice. If the file is accidentally committed to version control or accessed by unauthorized users, the credentials could be compromised, leading to potential data breaches. IAM roles are the standard, secure alternative to this method.

• ✓

  Attach an IAM role to the EC2 instance with an S3 access policy.

  Why this is correct

  IAM roles provide temporary credentials via the AWS metadata service, which the SDK uses automatically. This method avoids hardcoding credentials on the disk, follows the principle of least privilege, and ensures that permissions are tied to the compute resource rather than a long-lived user identity.

• ✗

  Configure the S3 bucket policy to allow public read access to the specific EC2 instance's public IP address.

  Why it's wrong here

  Bucket policies that rely on public IP addresses are insecure and difficult to maintain. IP addresses for EC2 instances can change, and public access policies expose the bucket to the internet, increasing the attack surface. IAM roles are the correct, secure mechanism for service-to-service authorization within AWS.

• ✗

  Modify the instance security group to allow all traffic to and from the S3 endpoint.

  Why it's wrong here

  Security groups control network traffic at the instance level but do not govern authentication or authorization. Even if the network path is allowed, the instance still needs valid IAM credentials to perform API requests against S3. Security groups are irrelevant to the identity-based access requirements for S3.